fix(pollr): confirm a pending vote only from a successful ballot read

A timed-out withdrawal leaves the pending selection empty, and every load
resets the voter's choices to an empty placeholder before it reads, so a
failed re-read (or a failed poll lookup) matched [] == [] and announced
"Vote confirmed" while the old vote could still be on chain. The card now
confirms only from a completed, successful ballot read made after the
submission went unconfirmed (confirmsPendingVote, with a spec), keeping
the pending selection on any failed or in-flight read.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: PastaPastaPasta

components/poll/poll-card.tsx

@@ -1,6 +1,6 @@
 'use client'
 
-import { useCallback, useEffect, useState } from 'react'
+import { useCallback, useEffect, useRef, useState } from 'react'
 import { logger } from '@/lib/logger'
 import toast from 'react-hot-toast'
 import { ChartBarIcon } from '@heroicons/react/24/outline'
@@ -12,7 +12,7 @@ import { cn, formatNumber } from '@/lib/utils'
 import { categorizeError } from '@/lib/error-utils'
 import { pollrPollUrl } from '@/lib/poll-embed'
 import { pollrIsV4, pollrIsV5 } from '@/lib/constants'
-import { choiceDelta, normalizeChoices, sameChoices } from '@/lib/pollr-rules'
+import { choiceDelta, confirmsPendingVote, normalizeChoices, sameChoices, type BallotRead, type PendingVote } from '@/lib/pollr-rules'
 import type { Poll, PollTally } from '@/lib/services'
 import { pollIsClosed, tallyIsFinal } from '@/lib/services/pollr-vote-service'
 
@@ -73,7 +73,12 @@ export function PollCard({ pollId, postContent, postAuthorId, className }: PollC
   // v5: the selection a submission was asked for when one of its writes went
   // unconfirmed. The run stopped there, so later picks were never sent; the
   // ballot stays open on this selection until a re-read shows it recorded.
-  const [pendingWanted, setPendingWanted] = useState<number[] | null>(null)
+  const [pendingVote, setPendingVote] = useState<PendingVote | null>(null)
+  // The last completed, successful read of the voter's ballots — null while a
+  // load is in flight or when it failed. Only this may confirm a pending vote:
+  // `myVotes` is reset to an empty placeholder before every read.
+  const [ballotRead, setBallotRead] = useState<BallotRead | null>(null)
+  const readGeneration = useRef(0)
 
   const userId = user?.identityId ?? null
   // v5 ballots stay editable until the poll closes; v3 ballots are permanent.
@@ -92,6 +97,7 @@ export function PollCard({ pollId, postContent, postAuthorId, className }: PollC
       // failed lookup can't leave the previous account's (or poll's) answer on
       // screen as if it belonged to the one now being loaded.
       setMyVotes([])
+      setBallotRead(null)
       setTally(null)
       try {
         const { pollrPollService, pollrVoteService } = await import('@/lib/services')
@@ -122,6 +128,8 @@ export function PollCard({ pollId, postContent, postAuthorId, className }: PollC
         // ballot instead of guessing that the user hasn't voted.
         if (votesResult.status === 'fulfilled') {
           setMyVotes(votesResult.value)
+          readGeneration.current += 1
+          setBallotRead({ choices: votesResult.value, generation: readGeneration.current })
         } else {
           logger.error('PollCard: failed to load own votes', votesResult.reason)
           setVotesUnavailable(true)
@@ -145,7 +153,7 @@ export function PollCard({ pollId, postContent, postAuthorId, className }: PollC
   const stopEditing = useCallback(() => {
     setSelected([])
     setEditing(false)
-    setPendingWanted(null)
+    setPendingVote(null)
   }, [])
 
   // Reset any pending selection when switching polls or signing in/out.
@@ -157,14 +165,15 @@ export function PollCard({ pollId, postContent, postAuthorId, className }: PollC
     setClosedOnChain(false)
   }, [pollId])
 
-  // An unconfirmed submission is settled once a fresh read shows the voter's
-  // ballots selecting what was asked for. Until then the ballot stays open on
-  // it, so "Update vote" sends whatever part has not landed.
+  // An unconfirmed submission is settled once a successful ballot read, made
+  // after it went unconfirmed, shows the voter's ballots selecting what was
+  // asked for. A failed or in-flight read settles nothing. Until then the
+  // ballot stays open on it, so "Update vote" sends whatever has not landed.
   useEffect(() => {
-    if (loading || !pendingWanted || !sameChoices(myVotes, pendingWanted)) return
+    if (!confirmsPendingVote(pendingVote, ballotRead)) return
     stopEditing()
     toast.success('Vote confirmed')
-  }, [loading, myVotes, pendingWanted, stopEditing])
+  }, [pendingVote, ballotRead, stopEditing])
 
   const isClosed = closedOnChain || (poll ? pollIsClosed(poll) : false)
   const hasVoted = myVotes.length > 0
@@ -212,7 +221,7 @@ export function PollCard({ pollId, postContent, postAuthorId, className }: PollC
       // Sent, but not seen yet. Leave the vote and tally as they were rather
       // than replace them with a read that likely predates the write.
       toast('Your vote was sent but is not confirmed yet.', { icon: '⏳', duration: 6000 })
-      setPendingWanted(wanted)
+      setPendingVote({ wanted, afterRead: readGeneration.current })
       setSelected(wanted)
       setEditing(true)
       return
@@ -513,7 +522,7 @@ export function PollCard({ pollId, postContent, postAuthorId, className }: PollC
             )}
           </div>
 
-          {pendingWanted && (
+          {pendingVote && (
             <p className="text-xs text-gray-500 dark:text-gray-400">
               Not confirmed yet.{' '}
               <button

lib/pollr-rules.test.ts

@@ -5,6 +5,7 @@ import {
   applyChoiceDelta,
   charCount,
   choiceDelta,
+  confirmsPendingVote,
   isChoiceIndex,
   normalizeChoices,
   pollEndsAt,
@@ -122,6 +123,26 @@ describe('ballot plan, multi choice', () => {
   })
 })
 
+describe('confirming an unconfirmed vote', () => {
+  const withdrawal = { wanted: [], afterRead: 3 }
+
+  it('needs a successful read made after the submission went unconfirmed', () => {
+    // No completed read (it failed, or is still in flight): nothing confirms,
+    // even though an empty withdrawal "matches" an empty placeholder.
+    expect(confirmsPendingVote(withdrawal, null)).toBe(false)
+    // The read the submission was planned against predates it.
+    expect(confirmsPendingVote(withdrawal, { choices: [], generation: 3 })).toBe(false)
+    expect(confirmsPendingVote(withdrawal, { choices: [], generation: 4 })).toBe(true)
+  })
+
+  it('needs the read to show exactly the wanted selection', () => {
+    expect(confirmsPendingVote(withdrawal, { choices: [1], generation: 4 })).toBe(false)
+    expect(confirmsPendingVote({ wanted: [0, 2], afterRead: 0 }, { choices: [0], generation: 1 })).toBe(false)
+    expect(confirmsPendingVote({ wanted: [0, 2], afterRead: 0 }, { choices: [2, 0], generation: 1 })).toBe(true)
+    expect(confirmsPendingVote(null, { choices: [], generation: 9 })).toBe(false)
+  })
+})
+
 describe('choices and tallies', () => {
   it('reads the recorded choices off ballots, skipping withdrawn ones', () => {
     expect(recordedChoices([ballot(2, 2), ballot(0, null), ballot(1, 1)])).toEqual([1, 2])

lib/pollr-rules.ts

@@ -160,6 +160,30 @@ export function sameChoices(a: readonly number[], b: readonly number[]): boolean
   return left.length === right.length && left.every((choice, index) => choice === right[index])
 }
 
+/** A submission whose last write went unconfirmed, and the ballot read it was made after. */
+export interface PendingVote {
+  wanted: number[]
+  /** The generation of the last successful ballot read when it went unconfirmed. */
+  afterRead: number
+}
+
+/** A completed, successful read of the voter's ballots. */
+export interface BallotRead {
+  choices: number[]
+  /** Increases with every successful read. */
+  generation: number
+}
+
+/**
+ * Whether `read` settles `pending`: it is a successful read made AFTER the
+ * submission went unconfirmed, and it shows exactly the wanted selection. A
+ * read that failed, or one still in flight, is no read at all — an empty
+ * placeholder must never pass for a recorded withdrawal.
+ */
+export function confirmsPendingVote(pending: PendingVote | null, read: BallotRead | null): boolean {
+  return pending !== null && read !== null && read.generation > pending.afterRead && sameChoices(read.choices, pending.wanted)
+}
+
 /** What changed between two selections: the choices `next` adds and the ones it drops. */
 export function choiceDelta(previous: readonly number[], next: readonly number[]): { added: number[]; removed: number[] } {
   const before = new Set(previous)